Efficient code generation in a region-based dynamic binary translator

Abstract

Region-based JIT compilation operates on translation units comprising multiple basic blocks and, possibly cyclic or conditional, control flow between these. It promises to reconcile aggressive code optimisation and low compilation latency in performancecritical dynamic binary translators. Whilst various region selection schemes and isolated code optimisation techniques have been investigated it remains unclear how to best exploit such regions for efficient code generation. Complex interactions with indirect branch tables and translation caches can have adverse effects on performance if not considered carefully. In this paper we present a complete code generation strategy for a region-based dynamic binary translator, which exploits branch type and control flow profiling information to improve code quality for the common case. We demonstrate that using our code generation strategy a competitive region-based dynamic compiler can be built on top of the LLVM JIT compilation framework. For the ARM V5T target ISA and SPEC CPU 2006 benchmarks we achieve execution rates of, on average, 867 MIPS and up to 1323 MIPS on a standard X86 host machine, outperforming state-of-the-art QEMU-ARM by delivering a speedup of 264%.

High Speed Cycle-Approximate Simulation of Embedded Cache-Incoherent and Coherent Chip-Multiprocessors

“…This reduction in simulation efficiency can be reduced by using a on-FPGA embedded or soft processor to run the software fall-back model rather than require the high-latency communication to the host computer. The 16-core simulation achieves simulation rates up to 62 MIPS, and even the theoretical 100 MIPS throughput of the BlueSPARC engine is significantly slower than modern JIT compiled software simulators (typically several hundred MIPS per core, with results up to 1323 MIPS per core achieved by the current state of the art [47]). …”

SimBench: A portable benchmarking methodology for full-system simulators

“…This means that these benchmarks also measure the handling of self modifying code. Furthermore, when optimisations such as concurrent code generation [7] or region-based code generation [28] are applied, these benchmarks will help to measure the effectiveness of these techniques.…”

“…Control flow can also be split into direct (where the branch target is known in advance, and is encoded as an absolute or relative path into the instruction) and indirect (where the branch target is read from memory or a register). A large amount of work has been done on optimising the various forms of control flow [28,20,15,17].…”

“…The SPEC2006 suite, which is a collection of benchmarks based on real world applications such as the gcc compiler, is used (such as in [28,31,26,32,9,15,7]). This has the advantage of reflecting real-world conditions and applications.…”

Hardware-Accelerated Cross-Architecture Full-System Virtualization

“…Guest basic blocks are terminated at page boundaries for memory protection purposes. Normal control flow out of a block is optimized utilising techniques from Spink et al [2014], which includes directly chaining to other basic blocks that are part of the same memory page to avoid costly returns to the main execution loop. If a translation does not exist, or the destination does not live on the same page, then control is returned to the main execution loop, which will then handle the situation accordingly.…”